He could shut down external access, deploy changes to capture plain text passwords, then turn everything off. Technically he's complied...